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Why GAO Did This Study 

The Department of Homeland 
Security (DHS), the third largest 
department in federal procurement 
spending in fiscal year 2006, has 
faced ongoing cost, schedule, and 
performance problems with major 
acquisitions and procurement of 
services. In December 2005, DHS 
established an acquisition oversight 
program to provide insight into and 
improve components' acquisition 
programs. 

In 2006, GAO reported that DHS 
faced challenges in implementing 
its program. Congress mandated 
that DHS develop an oversight plan 
and tasked GAO with analyzing the 
plan. GAO (1) evaluated actions 
DHS and its components have 
taken to implement the acquisition 
oversight plan and (2) identified 
implementation challenges. GAO 
also identified opportunities for 
strengthening oversight conducted 
through the plan. 

GAO reviewed relevant DHS 
documents and GAO and DHS 
Inspector General reports and 
interviewed officials in the office of 
the Chief Procurement Officer 
(CPO) and nine DHS components. 



What GAO Recommends 



What GAO Found 

The CPO has taken several actions to implement DHS's acquisition oversight 
plan — which generally incorporates basic principles of an effective and 
accountable acquisition function. The plan monitors acquisition 
performance through four recurring reviews: self-assessment, operational 
status, on-site, and acquisition planning. Each component has completed the 
first self-assessment, which has helped components identify and prioritize 
acquisition weaknesses. In addition, each component has submitted an 
initial operational status report to the CPO and on-site reviews are being 
conducted. Despite this progress, the acquisition planning reviews are not 
sufficient to determine if components adequately plan their acquisitions — in 
part because a required review has not been implemented and the CPO lacks 
visibility into components' planning activities. 

DHS faces two key challenges in implementing its acquisition oversight plan. 
First, the CPO has had limited oversight resources to implement plan 
reviews. However, recent increases in staff have begun to address this 
challenge. Second, the CPO lacks sufficient authority to ensure components 
comply with the plan — despite being held accountable for departmentwide 
management and oversight of the acquisition function. GAO has previously 
recommended that DHS provide the CPO with sufficient enforcement 
authority to enable effective acquisition oversight. 

In addition to these challenges, GAO identified two opportunities to 
strengthen internal controls for overseeing the plan's implementation and for 
increasing knowledge sharing. Specifically, independent evaluations of 
DHS's oversight program could help ensure that the plan maintains its 
effectiveness over time. Sharing knowledge and lessons learned could 
provide DHS's acquisition workforce with the information needed to 
improve their acquisition processes and better achieve DHS's mission. 



GAO is recommending that the 
CPO reevaluate the approach to the 
acquisition planning reviews and 
that DHS enhance internal controls 
to strengthen the oversight plan 
through periodic external reviews 
and knowledge sharing. DHS 
concurred with GAO's 
recommendations. 

www.gao.gov/cgi-bin/getrpt7GAO-07-900. 

To view the full product, including the scope 
and methodology, click on the link above. 
For more information, contact John Hutton at 
(202)512-4841 orhuttonj@gao.gov. 
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Abbreviations 



AAP Advanced Acquisition Planning 

CPO Chief Procurement Officer 

DHS Department of Homeland Security 

FEMA Federal Emergency Management Agency 

FLETC Federal Law Enforcement Training Center 

GCR Gulf Coast Recovery 

HCA Head of Contracting Activity 

0P0 Office of Procurement Operations 
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— Accountability * Integrity * Reliability 



United States Government Accountability Office 
Washington, DC 20548 



June 13, 2007 

The Honorable Robert C. Byrd 
Chairman 

The Honorable Thad Cochran 
Ranking Member 

Subcommittee on Homeland Security 
Committee on Appropriations 
United States Senate 

The Honorable David E. Price 
Chairman 

The Honorable Harold Rogers 
Ranking Member 

Subcommittee on Homeland Security 
Committee on Appropriations 
House of Representatives 

Since it was established, the Department of Homeland Security (DHS) has 
been responsible for integrating 22 federal agencies with disparate 
missions into one department. In fiscal year 2006, DHS obligated 
$15.6 billion for goods and services, making it the third largest department 
in federal procurement spending. DHS components have experienced 
ongoing cost, schedule, and performance problems with major 
acquisitions as well as procurement of services. Since January 2003, GAO 
has designated the implementation and transformation of DHS a high-risk 
area, stating the need for management capacity and oversight 
mechanisms. 1 

In December 2005, DHS established an acquisition oversight program in 
addition to existing oversight mechanisms, such as the investment review 
process. The program is designed to provide the Chief Procurement 
Officer (CPO) comprehensive insight into each component's acquisition 
programs and disseminate successful acquisition management approaches 
throughout DHS. 2 In 2006, we reported that DHS faced challenges in 
implementing this program, due to unclear accountability for acquisition 



'GAO, High-Risk Series: An Update, GAO-03-119 (Washington D.C.: January 2003). 
2 DHS Management Directive 0784, Acquisition Oversight Program. 
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outcomes and inadequate staffing to conduct departmentwide oversight. 3 
Subsequent to our report, Congress, in a conference report accompanying 
the DHS fiscal year 2007 Appropriations bill, directed DHS to submit a 
plan to the Appropriations Committees by January 2007 identifying 
necessary oversight resources and how improvements in the performance 
of its procurement functions will be achieved. 4 GAO was required to assess 
the plan. 

In April 2007, we briefed your Committees on our analysis and findings. 
This report expands on that briefing. Specifically, we (1) evaluated the 
actions DHS and its components have taken to implement the acquisition 
oversight plan through May 2007 and (2) identified the challenges DHS 
faces in implementing the plan. We also identified opportunities for 
strengthening oversight conducted through the plan. 

To conduct our work, we reviewed relevant GAO and DHS Office of the 
Inspector General reports and DHS documents, such as the oversight plan, 
completed reviews, and guidance to components. We interviewed officials 
in the office of the CPO and nine DHS components. Appendix I presents 
our scope and methodology in more detail. We conducted our work from 
February 2007 to June 2007 in accordance with generally accepted 
government auditing standards. 



The CPO, responsible for providing oversight reviews to verify the 
integrity of component acquisition processes, has taken several actions to 
implement DHS's acquisition oversight plan. The plan generally 
incorporates basic principles of an effective and accountable acquisition 
function and includes mechanisms to monitor acquisition performance 
through four recurring reviews: self-assessment, operational status, on- 
site, and acquisition planning. Each of the 9 components with 
procurement offices has completed the first self -assessment, which have 
helped components identify and prioritize acquisition weaknesses. In 
addition, each component has submitted initial operational status reports 
to the CPO, which are currently under review. CPO-led teams are also 
conducting on-site reviews of components. However, the CPO has not 



3 GAO, Interagency Contracting: Improved Guidance, Planning, and Oversight Would 
Enable the Department of Homeland Security to Address Risks, GAO-06-996 (Washington, 
D.C.: Sept. 27, 2006). 

4 H.R. Rep. No. 109-699, at 118 (2006). 
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developed sufficient mechanisms to verify that components complete key 
elements of acquisition planning reviews. For example, most components 
have not conducted an annual review of their acquisition planning 
processes — though required to do so since December 2005 — and the CPO 
has yet to check whether components have fulfilled this requirement. 

DHS faces challenges in implementing its acquisition oversight plan. First, 
the CPO has limited oversight resources to implement the plan, but has 
made progress in increasing staff to authorized levels. Specifically, when 
implementation of the plan began in 2006, only two personnel were 
assigned acquisition oversight as their primary duty. The CPO received 
funding for eight additional oversight positions and as of June 2007, seven 
of the additional positions had been filled. Second, the CPO, who is held 
accountable for departmentwide management and oversight of the 
acquisition function, lacks sufficient authority to ensure components take 
corrective actions based on oversight review recommendations. We have 
previously recommended that the Secretary of Homeland Security provide 
the CPO with sufficient enforcement authority to enable effective 
acquisition oversight. 

In addition to these challenges, we identified two opportunities based on 
federal standards to strengthen internal controls for overseeing the plan's 
implementation and for increasing knowledge sharing. Specifically, 
periodic assessments of the oversight program by the DHS Inspector 
General or an external auditor could help ensure that the plan maintains 
its effectiveness over time. Sharing knowledge and lessons learned from 
the oversight plan reviews through memorandums and regular meetings 
could provide DHS's acquisition workforce with information needed to 
improve their acquisition processes and better achieve DHS's mission. 

To improve oversight provided in the plan, we are recommending that the 
CPO reevaluate its approach to the acquisition planning reviews and 
determine whether the oversight mechanisms are sufficient to improve 
component acquisition planning. In addition, we are recommending that 
DHS enhance internal controls to strengthen the effectiveness of the 
oversight plan through periodic external reviews and knowledge sharing. 
In written comments on a draft of this report, DHS concurred with our 
recommendations. In addition, DHS commented on planned actions 
regarding acquisition authority including revising a management directive 
and designating the Chief Acquisition Officer for the department. DHS's 
comments are included in their entirety in appendix II. 
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BcLCkSrOlind ^ ^ e Department of Homeland Security was created and tasked 

" with integrating numerous agencies and offices with varying missions 

from the General Services Administration; the Federal Bureau of 
Investigation; and the Departments of Agriculture, Defense, Energy, Health 
and Human Services, Justice, Transportation, and Treasury; as well as the 
Coast Guard and the Secret Service. 



Eight DHS components have internal procurement offices with a Head of 
Contracting Activity (HCA) who reports directly to the component head 
and is accountable to the CPO. 5 The Office of Procurement Operations 
(OPO) also has an HCA who provides contracting support to all other 
components and reports directly to the CPO. The HCA for each 
component has overall responsibility for the day-to-day management of 
the component's acquisition function. Figure 1 shows the organizational 
relationship between the HCAs and the CPO. 



5 These components joined DHS with their own internal procurement offices. 
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Figure 1: DHS Components with HCAs and Lines of Reporting 
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Source: DHS (data); GAO (analysis and presentation). 

Note: The Office of Procurement Operations provides contracting support to multiple DHS 
components, not shown in this figure, which do not have their own acquisition staff. During our 
review, Gulf Coast Recovery (GCR) had its own HCA. CPO officials told us that as of May 2007 
FEMA's HCA subsumed responsibility for GCR contracting efforts. 
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We reported in September 2006 that DHS planned to fully implement its 
acquisition oversight program during fiscal year 2007. 6 The plan is 
composed of four recurring reviews: self -assessment, operational status, 
on-site, and acquisition planning. The CPO has issued an acquisition 
oversight program guidebook, provided training on self -assessment and 
operational status reviews, and began implementation of the four reviews 
in the plan (see table 1). 



Table 1 : Four Oversight Plan Reviews 



Description Frequency Status 

Self-assessment 

HCA for each component assesses the component's staff, processes, Annually 
and programs. 

Operational status reviews 

The component assesses the status of the acquisition function and Quarterly 
submits a quarterly narrative and data on performance metrics to the 
CPO, and the CPO holds a quarterly meeting with each individual 
HCA to discuss the results. 

The HCA has 30 days to provide the CPO with an action plan in 
response to the review and is responsible to ensure that action items 
are completed. 

On-site reviews 

A matrixed DHS team led by the CPO reviews each component's 
compliance with acquisition regulations, contract administration, use 
of good business judgment, and verification of procurement data. 

The head of the component is responsible for ensuring that the 
findings of the reviews are acted upon and closed out in a timely 
manner. 

Acquisition planning reviews 

This review has three elements: Ongoing 

(1) Individual Acquisition Plans-The CPO reviews component's 
acquisition plans that exceed a contract value of $50 million for most 
components. 3 

(2) Acquisition Planning Review-Component HCAs review programs Annually Not implemented as planned 
and assess acquisition planning process. 

(3) Advanced Acquisition Planning (AAP) database-Components are Quarterly Components enter information into 
required to enter information on all acquisitions over $100,000 into the database 

the database. 



Source: GAO analysis of DHS data. 

"The CPO reviews acquisitions that exceed $5 million for Secret Service and FLETC. 



Plan Implementation 
Is Under Way, but 
Acquisition Planning 
Oversight May Not Be 
Sufficient 



Components completed first 
assessment as of March 2007 



Components have submitted their 
reports as of May 2007 and the 
CPO review is under way 



Minimum of once every 3 
years (rotating) unless 
compelling reasons 
necessitate more frequent 
reviews 



Office of Procurement Operations 
review began in March 2007; 
Federal Law Enforcement Training 
Center (FLETC) review to start in 
June 2007 



CPO review of acquisition plans 
under way 



b GAO-06-996. 
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The acquisition oversight plan generally incorporates basic principles of 
an effective and accountable acquisition function and includes 
mechanisms to monitor acquisition performance. Specifically, the plan 
incorporates DHS policy, internal controls, and elements of an effective 
acquisition function: organizational alignment and leadership, policies and 
processes, human capital, knowledge and information management, and 
financial accountability. 7 While it is too early to assess the plan's overall 
effectiveness in improving acquisition performance, initial implementation 
of the first self-assessment has helped most components prioritize actions 
to address identified weaknesses. In addition, the CPO has helped several 
components implement organizational and process changes that may 
improve acquisition performance over time. For example, one component, 
with the assistance of the CPO, elevated its acquisition office to a level 
equivalent to its financial office. 

However, the acquisition planning reviews are not sufficient to determine 
if components' adequately plan their acquisitions. Federal acquisition 
regulations and DHS directives require agencies to perform acquisition 
planning in part to ensure good value, including cost and quality. 
Component HCAs are responsible to ensure that acquisition plans are 
completed in a timely manner, include an efficient and effective 
acquisition strategy and the resulting contract action or actions support 
the component's mission. Inadequate procurement planning can lead to 
higher costs, schedule delays, and systems that do not meet mission 
objectives. Several recent reviews have identified problems in DHS's 
acquisition planning. In 2006, we reported that DHS often opted for speed 
and convenience in lieu of planning and analysis when selecting a 
contracting method and may not have obtained a good value for millions 
of dollars in spending. 8 As part of a 2006 special review of Federal 
Emergency Management Agency's (FEMA) contracts, DHS's CPO found 
significant problems with the requirements process and acquisition 
strategy and recommended in part that FEMA better plan acquisitions. 9 



7 GAO, Framework for Assessing the Acquisition Function at Federal Agencies, 
GAO-05-218G (Washington D.C.: September 2005). 

8 GAO-06-996. 

9 As part of the oversight plan, the CPO conducts special on-site reviews in response to 
issues that need immediate attention. At the request of the Office of Management and 
Budget's Office of Federal Procurement Policy, the CPO reviewed several FEMA programs 
in 2006, focusing on the Hurricane Katrina response. The CPO is currently conducting a 
follow-up review of FEMA to determine whether corrective actions have been taken. 
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For example, the CPO reported that FEMA's total cost for its temporary 
housing program could have been significantly reduced if FEMA had 
appropriately planned to acquire temporary homes before the fiscal year 
2005 hurricane season. A 2006 internal review of the Office of 
Procurement Operation's contracts similarly found little evidence that 
acquisition planning occurred in compliance with regulations. While a key 
goal of the oversight program is to improve acquisition planning, we found 
potential problems with each of the three elements of the acquisition 
planning reviews, as shown in table 2. 



Table 2: Potential Problems with Acquisition Planning Reviews 



Purpose 



Potential Problems 



CPO reviews certain individual acquisition plans 



The CPO reviews certain acquisition plans to ensure 
that each complies with regulations and policies and 
also provides recommendations and guidance. 



The CPO's review is advisory because the component HCA is responsible 
to ensure that the plan complies with regulations and that the resulting 
acquisition meets the component's mission requirements in an efficient and 
effective manner. 

The HCA is not required to incorporate the CPO's comments into the plan. 
Instead, the HCA must document in the contract file how the comments 
were addressed. 

As a result, the CPO has little assurance that review comments are 
included in the final versions of the acquisition plans. 



HCAs review their component's acquisition planning process each year 



Annual reviews are intended to ensure the efficiency and 
effectiveness of the components' acquisition planning 
process. 



The CPO does not monitor whether HCAs complete the annual acquisition 
planning reviews. 

Most component HCAs were not aware of the requirement to complete an 
annual acquisition planning review and had not done so. 

As a result, HCAs and the CPO may not identify and address poor 
acquisition planning processes or opportunities to strengthen processes. 



HCAs update the AAP database 



HCAs are to provide data into the database to publicize 
contracting opportunities and to assist components in 
managing schedules for planned acquisitions. 



The CPO has not established an effective mechanism to monitor the 
database: 

In reviewing individual acquisition plans, the CPO has not been able to 
establish a process that allows them to check that required information is 
entered into the database. 

During the first on-site review at the Office of Procurement Operations, 
CPO officials indicated they could not verify the accuracy and 
completeness of Office of Procurement Operations' information in the 
database— as it had intended— because the database does not retain 
historical data for comparing the database to documents. 

As a result, the CPO's visibility into the components' planning activities is 
limited. 



Source: GAO analysis of DHS data and interviews with DHS officials. 



Page 8 



GAO-07-900 DHS Acquisition Oversight Plan 



The CPO Faces 
Challenges in 
Implementing 
Reviews and 
Corrective Actions 



DHS faces two challenges in achieving the goals of its acquisition 
oversight plan. First, the CPO has had limited resources to implement the 
plan reviews. When implementation of the plan began in 2006, only two 
personnel were assigned acquisition oversight as their primary duty. The 
CPO received funding for eight additional oversight positions. However, 
officials told us that they have struggled to find qualified individuals. As of 
June 2007, seven positions had been filled. As part of the Department's 
fiscal year 2008 appropriation request, the CPO is seeking two additional 
staff, for a total of 12 oversight positions. The CPO will also continue to 
rely on resources from components to implement the plan, such as 
providing staff for on-site reviews. 



Second, while the CPO can make recommendations based on oversight 
reviews, the component head ultimately determines what, if any, action 
will be taken. DHS's organization relies on cooperation and collaboration 
between the CPO and components to accomplish departmentwide 
acquisition goals. However, to the extent that the CPO and components 
disagree on needed actions, the CPO lacks the authority to require 
compliance with recommendations. We have previously reported that the 
DHS system of dual accountability results in unclear working relationships 
between the CPO and component heads. DHS policy also leaves unclear 
what enforcement authority the CPO has to ensure that acquisition 
initiatives are carried out. In turn, we recommended that the Secretary of 
Homeland Security provide the CPO with sufficient enforcement authority 
to effectively oversee the Department's acquisitions — a recommendation 
that has yet to be implemented. 10 CPO officials believe that there are other 
mechanisms to influence component actions, such as providing input into 
HCA hiring decisions and performance appraisals. 



External Reviews and 
Knowledge Sharing 
Could Improve 
Acquisition Oversight 



Making the most of opportunities to strengthen its acquisition oversight 
program — along with overcoming implementation challenges — could 
position the agency to achieve better acquisition outcomes. We identified 
two such opportunities: periodic external assessments of the oversight 
program and sharing knowledge gained from the oversight plan reviews 
across the department. 



GAO, Homeland Security: Successes and Challenges in DHS's Efforts to Create an 
Effective Acquisition Organization, GAO-05-179 (Washington, D.C.: Mar. 29, 2005). 
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Federal internal control standards call for periodic external assessments 
of programs to help ensure their effectiveness. 11 An independent 
evaluation of DHS's acquisition oversight program by the Inspector 
General or an external auditor could help strengthen the oversight 
conducted through the plan and better ensure that the program is fully 
implemented and maintaining its effectiveness over time. In particular, an 
external assessment with results communicated to appropriate officials 
can help maintain the strength of the oversight program by alerting DHS to 
acquisition concerns that require oversight, as well as monitoring the 
plan's implementation. For example, the plan initially called for 
components to complete the self-assessment by surveying their acquisition 
staff; however, the level of staff input for the first self -assessments was left 
to the discretion of the HCAs. Specifically, CPO officials advised HCAs to 
complete the questions themselves, delegate the completion to one or 
more staff members, or select a few key people from outside their 
organization to participate. While evolution of the plan and its 
implementation is to be expected and can result in improvements, periodic 
external assessments of the plan could provide a mechanism for 
monitoring changes to ensure they do not diminish oversight. 

Federal internal control standards also call for effective communication to 
enable managers to carry out their responsibilities and better achieve 
components' missions. 12 The CPO has been assigned responsibility for 
ensuring the integrity of the oversight process — in part by providing 
lessons learned for acquisition program management and execution. While 
the CPO intends to share knowledge with components by posting lessons 
learned from operational status reviews to DHS's intranet, according to 
CPO officials, the Web site is currently limited to providing guidance and 
training materials and does not include a formal mechanism to share 
lessons learned among components. In addition to the Web site, other 
opportunities may exist for sharing knowledge. For example, CPO officials 
indicated that the CPO meets monthly with component HCAs to discuss 
acquisition issues. The monthly meetings could provide an opportunity to 
share and discuss lessons learned from oversight reviews. Finally, 
knowledge could be regularly shared with component acquisition staff 
through internal memorandums or reports on the results of oversight 
reviews. 



See GAO, Internal Control: Standards for Internal Control in the Federal Government, 
GAO/AIMD-00-2 1.3.1 (Washington D.C.: November 1999). 

12 GAO/AIMD-00-2 1.3.1. 
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Conclusion Integrating 22 federal agencies while implementing acquisition processes 

needed to support DHS's national security mission is a herculean effort. 
The CPO's oversight plan generally incorporates basic principles of an 
effective acquisition function, but absent clear authority, the CPO's 
recommendations for improved acquisition performance are, in effect, 
advisory. Additional actions are needed to achieve the plan's objectives 
and opportunities exist to strengthen oversight through enhanced internal 
controls. Until DHS improves its approach for overseeing acquisition 
planning, the department will continue to be at risk of failing to identify 
and address recurring problems that have led to poor acquisition 
outcomes. 



RGCOmniGnclcltionS for ^° i m P rove oversight of component acquisition planning processes and 

the overall effectiveness of the acquisition oversight plan, we recommend 

Executive Action that the Secretary of Homeland Security direct the Chief Procurement 

Officer to take the following three actions: 



• Reevaluate the approach to oversight of acquisition planning reviews 
and determine whether the mechanisms under the plan are sufficient to 
monitor component actions and improve component acquisition 
planning efforts. 

• Request a periodic external assessment of the oversight plan 
implementation and ensure findings are communicated to and 
addressed by appropriate officials. 

• Develop additional opportunities to share lessons learned from 
oversight reviews with DHS components. 



Agency Comments 
and Our Evaluation 



We provided a draft of this report to DHS for review and comment. In 
written comments, DHS generally agreed with our facts and conclusions 
and concurred with all of our recommendations and provided information 
on what actions would be taken to address them. 



Regarding the recommendation on acquisition planning, DHS stated that 
during on-site reviews they will verify that CPO comments on acquisition 
plans have been sufficiently addressed. DHS is also developing training for 
component HCAs and other personnel to emphasize that CPO comments 
related to compliance with applicable laws and regulations must be 
incorporated into acquisition plans. The CPO will also annually require an 
acquisition planning review as part of the oversight plan's operational 
status reviews. Additionally, DHS intends to change the advanced 
acquisition planning database so that historical data are available for 
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review. With regard to the recommendation for periodic external 
assessment of the oversight plan, DHS stated they plan to explore 
opportunities to establish a periodic external review of the oversight 
program. However, the first priority of the acquisition oversight office is to 
complete initial component on-site reviews. For the recommendation to 
develop additional opportunities to share lessons learned from oversight 
reviews, DHS stated it intends to share consolidated information from 
operational status and on-site reviews in regular meetings with component 
HCA staff. In addition, the CPO plans to explore further opportunities for 
sharing oversight results with the entire DHS acquisition community. 

DHS also responded to a 2005 GAO recommendation on the issue of the 
CPO lacking authority over the component HCAs. DHS commented that it 
is in the process of modifying its acquisition lines of business management 
directive to ensure that no DHS contracting organization is exempt. In 
addition, DHS stated that the Under Secretary for Management has 
authority as the Chief Acquisition Officer to monitor acquisition 
performance, establish clear lines of authority for making acquisition 
decisions, and manage the direction of acquisition policy for the 
department, and that these authorities also devolve to the CPO. Modifying 
the management directive to ensure no DHS contracting organization is 
exempt is a positive step. However, until DHS formally designates the 
Chief Acquisition Officer, and modifies applicable management directives 
to support this designation, DHS's existing policy of dual accountability 
between the component heads and the CPO leaves unclear the CPO's 
authority to enforce corrective actions to achieve the department's 
acquisition goals, which was the basis of our earlier recommendation. 

DHS's letter is reprinted in appendix II. DHS also provided technical 
comments which were incorporated as appropriate. 



Page 12 



GAO-07-900 DHS Acquisition Oversight Plan 



We are sending copies of this report to interested congressional 
committees and the Secretary of Homeland Security. We will also make 
copies available to others upon request. In addition, the report will be 
available at no charge on GAO's Web site at http://www.gao.gov. 

If you or your staff have questions regarding this report, please contact me 
at (202) 512-4841 or huttonj@gao.gov. Contact points for our Offices of 
Congressional Relations and Public Affairs may be found on the last page 
of this report. Principal contributors to this report were Amelia Shachoy, 
Assistant Director; William Russell; Tatiana Winger; Heddi Nieuwsma; 
Lily Chin; Karen Sloan; and Sylvia Schatz. 




John Hutton, Director 

Acquisition and Sourcing Management 
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Appendix I: Scope and Methodology 



To determine actions taken by DHS to implement the acquisition oversight 
plan and challenges DHS faces, we reviewed prior GAO and DHS Office of 
the Inspector General reports pertaining to acquisition oversight as well as 
relevant DHS documents, such as the oversight plan, documents of 
completed reviews and guidance to components, including training 
materials. We interviewed officials in the CPO's office and the nine DHS 
components with acquisition offices. We compared efforts undertaken to 
implement the plan by DHS officials against established program policies, 
the fiscal year 2007 implementation schedule, and other guidance 
materials. We reviewed four component self-assessments that were 
provided to us and also reviewed areas in which the CPO provided 
assistance to components based on self-assessment results. We also 
reviewed Standards for Internal Control in the Federal Government. 

We conducted our work from February 2007 to June 2007 in accordance 
with generally accepted government auditing standards. 
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Appendix II: Comments from the Department 
of Homeland Security 



U.S. Department of Homeland Security 

Washington, DC" 20528 




Homeland 
Security 



June 12, 2007 



Mr. John Hutton, Director 
Acquisition and Sourcing Management 
Government Accountability Office 
Washington, D.C. 

Dear Mr. Hutton: 

Re: Draft report GAO-07-900, "Department of Homeland Security: Progress and Challenges in 
Implementing the Department's Acquisition Oversight Plan." 

GAO notes "The acquisition oversight plan generally incorporates basic principles of an effective 
and accountable acquisition function and includes mechanisms to monitor acquisition performance. 
Specifically, the plan incorporates DHS policy, internal controls, and elements of an effective 
acquisition function: organizational alignment and leadership, policies and processes, human 
capital, knowledge and information management, and financial accountability." GAO also 
acknowledges that the CPO has helped several components reengineer processes that may improve 
acquisition performance over time. 

Attached are comments on the specific recommendations but we also wanted to address the issue of 
the Chief Procurement Officer's (CPO) authority over the Heads of Contracting Activities (HCA) 
at the DHS Components. The report states that "the CPO lacks sufficient authority to ensure 
components comply with the [oversight] plan" and restates an earlier GAO recommendation in 
GAO audit 05-179, Homeland Security Successes and Challenges in DHS's Efforts to Create an 
Effective Acquisition Organization, that "the Secretary of Homeland Security provides the CPO 
with sufficient enforcement authority to effectively oversee the Department's acquisition and 
manage risks" — a recommendation that has yet to be implemented. We respectfully do not agree 
with this recommendation. CPO has sufficient authority, including the ability to revoke or restrict 
the HCAs contracting authority, and the ability to concur in selection and performance of HCAs. 
Nevertheless, we concur with a prior GAO recommendation regarding a weakness in our current 
Acquisition Line of Business Management Directive and are in the process of modifying it to 
ensure that no DHS contracting organization is exempt from the directive. 

In testimony June 7, 2007, before the US Senate Committee on Homeland Security and 
Governmental Affairs Committee Subcommittee on Oversight of Government Management, the 
Federal Workforce and the District of Columbia, Under Secretary for Management Paul A. 
Schneider cited the Services Acquisition Reform Act which was enacted as part of Title XIV of the 
National Defense Authorization Act for Fiscal Year 2004 (Pub. L. 108-136, Nov. 24, 2003) (41 



www.dhs.gov 
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U.S.C. 414(a)), as the authority for the Under Secretary for Management and the Chief 
Procurement Officer for managing and directing the procurement function at the Department. 

As the Chief Acquisition Officer, the Under Secretary's authorities include in part: 

• Monitoring the performance of acquisition activities and acquisition programs of the 
Department, evaluating the performance of those programs on the basis of applicable 
performance measurements and advising the Secretary regarding the appropriate business 
strategy to achieve the mission of the Department. 

• Making acquisitions consistent with applicable laws and establishing clear lines of 
authority, accountability and responsibility for acquisition decision making within the 
Department. 

• Managing the direction of acquisition policy for the Department including implementation 
of the unique acquisition policies, regulation and standards of the Department. 

These authorities also devolve to the Chief Procurement Officer who reports to the Under 
Secretary. 

The following is the Departmental response to the recommendations contained in the report. 

Recommendation 1 . Reevaluate the approach to oversight of acquisition planning reviews and 
determine whether the mechanism under the plan is sufficient to monitor component actions and 
improve component acquisition planning efforts. 

Concur. DHS will take several steps to address this recommendation. First, DHS will include a 
review of acquisition plans as part of future on-site reviews to ensure that Office of the Chief 
Procurement Officer (OCPO) comments and recommendations on acquisition plans have been 
sufficiently addressed in the final acquisition plans. It is noted that if during the CPO review of an 
Acquisition Plan there are instances of a failure to comply with specific statutory or regulatory 
requirements, those are highlighted as mandatory comments that must be incorporated before 
proceeding, as opposed to the reviewers opinions on improving the plan as presented. Second, the 
CPO will develop a training module for presentation to Component HCAs and other relevant 
component personnel to emphasize this requirement and modify the Operational Assessment to 
include an annual reporting requirement on the Acquisition Planning review. Finally, the 
Advanced Acquisition Planning (AAP) database is a Web based reporting tool that satisfies the 
requirement for advanced acquisition planning as set forth in FAR Part 7 and is also a database 
from which the Small Business forecast is drawn. Upon discovery of the limited data availability 
on the Website hosting this database, CPO directed that the database be modified to address the 
data availability and archiving issue to ensure that full year data is available at any time and that 
archived data is available and easily accessed. 

Recommendation 2. Request a periodic external assessment of the oversight plan implementation 
and ensure findings are communicated to and addressed by appropriate officials. 
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Concur. The first priority of the Acquisition Oversight office is to complete the initial 
comprehensive on-site reviews of each component. Plans, activities and schedules to accomplish 
that by the 4 Quarter of FY 08 are in place. In the coming months the Acquisition Oversight 
office will explore opportunities for establishing a periodic third party review of the DHS Oversight 
program. This third party will likely be an outside agency such as the Federal Acquisition Institute 
or the Defense Acquisition University or another entity with a sufficient knowledge base in Federal 
Acquisition to be able to provide meaningful, constructive criticism of the program. 

Recommendation 3. Develop additional opportunities to share lessons learned from oversight 
reviews with DHS components. 

Concur. Steps are being taken in two specific areas to address this effort. First, the quarterly 
Operational Assessments, which are a common collection of acquisition and contracting related 
data, are being reviewed independently with each Head of Contracting Activity by the Acquisition 
Oversight office to ensure a common understanding of the information requested and consistent 
responses so that data can be consolidated and compared across components. The Oversight office 
is receiving positive feedback from the component HCAs interviewed to date that the data 
collection has already shown benefits to the HCAs by highlighting information that had otherwise 
been overlooked in their own assessments. The goal of this effort is to be able to consolidate the 
information in order to identify any outliers from a particular component in order for the CPO to 
specifically address them with the HCA. 

In addition, these reports, aggregated over a fiscal year will be used by the CPO to establish 
specific performance goals that the CPO sets for all of the HCAs in the Department. Second, the 
results of the comprehensive on-site reviews will be similarly aggregated to provide the CPO with 
an overarching view of the state of the acquisition and procurement function in the Department. As 
analyses are completed this will become a routine agenda item for the DHS CAO council, made up 
of the collective HCAs from all components which meets every month. The CPO will explore the 
recommendation that other analyses, reports or the results of reviews be shared across the entire 
DHS Acquisition community, bearing in mind that many of the reports will be component or 
program specific. 

We thank you again for the opportunity to review this most important report and provide 
comments. 



Sincerely, 




Director 

Departmental GAO/OIO Liaison Office 



(120651) 
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